ZKEACMS version 4.4 contains a hard‑coded HMAC‑SHA256 signing key in JwtBearerDefaults.cs that allows an unauthenticated attacker to forge JWT bearer tokens. By creating a token with the Name claim set to "admin" the attacker can bypass authentication and gain administrator privileges to modify articles, products, and read form submissions. This represents a classic authentication bypass flaw described by CWE‑321, where predictable credentials or cryptographic secrets compromise the integrity of a system.

The vulnerability affects the SeriaWei ZKEACMS product, specifically versions up to and including 4.4. Administrators running any deployment of ZKEACMS 4.4 or earlier are impacted and should verify their installed version.

The CVSS score of 8.8 classifies this as a high severity issue, indicating that successful exploitation provides complete control over protected resources. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting that while it is high risk, the likelihood of widespread exploitation remains uncertain. The attack vector is inferred to be through the REST API, where an attacker can craft HTTP requests containing a forged JWT without needing any prior authentication.